From 4c4cb16f37fbc4abedc23d2853719cdacd62875c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Cl=C3=A9ment=20D=C3=A9siles?=
 <1536672+cdesiles@users.noreply.github.com>
Date: Tue, 25 Aug 2026 23:47:34 +0200
Subject: [PATCH] fix(wireguard): allow ufw forwarding for server_mode tunnels

ufw FORWARD policy drop overrode the nft/iptables forward rules,
blocking all VPN traffic through the tunnel. Add routed rules in
both directions between the tunnel and primary interface.
---
 roles/wireguard/tasks/tunnel.yml | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)

diff --git a/roles/wireguard/tasks/tunnel.yml b/roles/wireguard/tasks/tunnel.yml
index 14a8f48..66f220e 100644
--- a/roles/wireguard/tasks/tunnel.yml
+++ b/roles/wireguard/tasks/tunnel.yml
@@ -83,6 +83,24 @@
     - _tunnel.server_mode | default(false)
     - _tunnel.port is defined
 
+- name: "Allow forwarding for {{ _tunnel.interface }}"
+  community.general.ufw:
+    rule: allow
+    route: true
+    interface_in: "{{ item.in }}"
+    interface_out: "{{ item.out }}"
+    comment: "Wireguard VPN forwarding ({{ _tunnel.interface }})"
+  retries: 5
+  delay: 2
+  register: _ufw_result
+  until: _ufw_result is succeeded
+  loop:
+    - in: "{{ _tunnel.interface }}"
+      out: "{{ _tunnel.primary_interface | default(wireguard_primary_interface) }}"
+    - in: "{{ _tunnel.primary_interface | default(wireguard_primary_interface) }}"
+      out: "{{ _tunnel.interface }}"
+  when: _tunnel.server_mode | default(false)
+
 - name: "Start and enable wg-quick@{{ _tunnel.interface }}"
   ansible.builtin.service:
     name: "wg-quick@{{ _tunnel.interface }}"